Why am I unable to fetch more then 1000000 records via a scheduled report from Splunk to email in a CSV?

[rohitvjoshi]

Hi Splukers ,

We have scheduled a report into get an email with CSV attachment for the everyday 6 AM.

My report is giving around 500000 records when i am running reporting manually into the Splunk server, as well as I am able to see all the records into .text format. However, the scheduled file i got into the mail is 50001 only.

I have already done all the necessary changes in/home/splunk/etc/system/local/limits.conf like below:

[scheduler]
max_action_results=100000000

[searchresults]
maxresultrows=100000000

As well $SPLUNK_HOME/etc/system/local/alert_actions.conf

[default]
maxresults = 100000000

Saved search for that report is already created so we have change the configuration in savedsearches.conf as well :

action.email.maxresults=100000000

After all the changes, we restarted the servers but still we are not getting all records into the email.

Please Suggest!!

Thanks
RJ

[rohitvjoshi · Accepted solution]

Hi Splunkers,

we had find the solution for this thread.we have to add dispatch.max_count=10000000 in savedsearches.conf file under the index.Now we are getting 10000000 records in Email.

By Default dispatch.max_count is 50000.

Cheers!!

[whrg]

Hello @rohitvjoshi,

I found this similar question: How to overcome CSV max results to email?

Check out the accepted answer. Try the following change (and restart Splunk afterwards):

$SPLUNK_HOME/etc/system/local/alert_actions.conf
[default]
maxresults = 100000000

[rohitvjoshi]

Thanks for your response!

we have already configured this configuration still we are not getting expected results.
we have to apply these changes in Search Head or Indexers.

[whrg]

I believe you have to apply it on the Search Head.

[rohitvjoshi]

Yeah , I have applied these configurations in Search Head but still not working.

My Cluster do not have Minimum Hardware as recommended by Splunk , Is there any impact of hardware on this ??

Thanks In advance!